CVE-2008-0310

Directory traversal vulnerability in pkgadd in SCO UnixWare 7.1.4 before p534589 allows local users to create or append to arbitrary files via ".." sequences in an unspecified environment variable, probably PKGINST.

CVSS v2.0 6.9 MEDIUM

6.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 3.4 / Impact : 10.0

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=676
http://www.sco.com/support/update/download/release.php?rid=324	Patch Vendor Advisory
http://ftp.sco.com/pub/unixware7/714/security/p534589/p534589.txt
http://www.securitytracker.com/id?1019787
http://secunia.com/advisories/29657	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/41759
https://www.exploit-db.com/exploits/5355

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:o:sco:unixware:7.1.4:*:*:*:*:*:*:*

Information

Published : 2008-04-07 10:44

Updated : 2017-09-28 18:30

NVD link : CVE-2008-0310

Mitre link : CVE-2008-0310

JSON object : View

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Advertisement

Products Affected

sco

unixware

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=676", "name": "20080403 SCO UnixWare pkgadd Directory Traversal Vulnerability", "tags": [], "refsource": "IDEFENSE"}, {"url": "http://www.sco.com/support/update/download/release.php?rid=324", "name": "http://www.sco.com/support/update/download/release.php?rid=324", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://ftp.sco.com/pub/unixware7/714/security/p534589/p534589.txt", "name": "SCOSA-2008.1", "tags": [], "refsource": "SCO"}, {"url": "http://www.securitytracker.com/id?1019787", "name": "1019787", "tags": [], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/29657", "name": "29657", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41759", "name": "sco-unixware-pkgadd-directory-traversal(41759)", "tags": [], "refsource": "XF"}, {"url": "https://www.exploit-db.com/exploits/5355", "name": "5355", "tags": [], "refsource": "EXPLOIT-DB"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Directory traversal vulnerability in pkgadd in SCO UnixWare 7.1.4 before p534589 allows local users to create or append to arbitrary files via \"..\" sequences in an unspecified environment variable, probably PKGINST."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-22"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2008-0310", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "MEDIUM", "impactScore": 10.0, "obtainAllPrivilege": true, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2008-04-07T17:44Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:sco:unixware:7.1.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-09-29T01:30Z"}